SSO Security Notes

1. The initString parameter in SSO security is used as follows:

   SSO uses Symmetric Encryption to validate and create an SSO token. The initString parameter within the configuration is used for initialization of the secret key. An application creates a token, and each application that uses the same initString parameter validates the token.

   Note The following information is very important:

   • It is not possible to use SSO without setting the initString parameter.
   • The initString parameter is confidential information and should be treated as such in terms of publishing, transporting, and persistency.
   • Applications that integrate with each other can share the initString using SSO.
   • The minimum length of the initString is 12 characters.
2. Disable SSO unless it is specifically required.

3. The application that uses the weakest authentication framework, and issues an SSO token that is trusted by other integrated applications, determines the level of authentication security for all the applications.

   recommends that only applications using strong and secure authentication frameworks issue an SSO token.

4. Symmetric encryption implication:

   SSO uses symmetric cryptography for issuing and validating SSO tokens. Therefore, any application using SSO can issue a token to be trusted by all other applications sharing the same initString.

   This potential risk is relevant when an application sharing the initString either resides or is accessible in an untrusted location.

5. User roles:

   SSO does not share user roles between integrated applications. Therefore, the integrated application must monitor user roles. recommends you share the same user registry (as LDAP/AD) among all integrated applications.

   Failure to manage user roles might cause security breaches and negative application behavior. For example, the same user name might be assigned to different roles in the integrated applications.

   There could be situations when a user logs on to application A, then accesses application B that uses container or application authentication. The failure to manage the user role will force the user to manually log on to application B and enter a username. If the user enters a different user name than the one used to log on to application A, the following unexpected behavior can arise: If the user subsequently accesses a third application, application C, from application A or application B, then the user will access it using the user names that were used to log on to application A or application B respectively.

6. Identity Manager is used for an authentication:

   All unprotected resources in the Identity Manager must be configured as nonsecure URL settings in the SSO configuration.

7. SSO demonstration mode:

   • Use the SSO demonstration mode for demonstrative purposes only.
   • Only use the demonstration mode in unsecured networks.
   • Do not use the demonstration mode in production. Any combination of the demonstration mode with the production mode should not be used.